Low
Investigation
Announced
Austria · Sep 25, 2025
noyb uncovers over 40,000 CRIF credit queries linking Austrian banks, telecoms and retailers
noyb obtained data requests from 2,440 individuals and analyzed more than 40,000 CRIF credit queries, finding that banks, telecoms and other firms provide personal address data to the credit agency. The analysis shows gender and geographic…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Ireland · Sep 18, 2025
Former Meta lobbyist Niamh Sweeney appointed Irish DPC commissioner
Niamh Sweeney, a former senior Meta lobbyist, is set to join the Irish Data Protection Commission (DPC) as a commissioner in October. The DPC is the EU lead privacy regulator for major US tech firms. The appointment raises concerns about…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
In effect
France · Sep 4, 2025
CNIL fines Google €325 million for unsolicited Gmail advertising
The French data protection authority CNIL has issued a decision siding with privacy NGO noyb and fined Google €325 million for sending unsolicited advertising emails to Gmail users without consent. The authority also ordered Google to stop…
CNIL · ePrivacy Directive
Low
Enforcement
Announced
Germany · Aug 7, 2025
noyb sends cease‑and‑desist to Meta over AI training of EU users’ data
noyb commissioned a Gallup survey of 1,000 German Meta users, finding only 7% want their personal data used for AI training. Based on the results, noyb sent a cease‑and‑desist letter to Meta alleging GDPR violations and is assessing a…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Filed
Austria · Jun 26, 2025
noyb files complaint against Bumble for unlawful AI Icebreakers in Austria
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Bumble's AI Icebreakers process personal data without valid consent and rely on an invalid legitimate‑interest claim. The complaint cites violations of GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jun 16, 2025
noyb warns Meta's planned WhatsApp ads may breach GDPR and DMA
noyb alleges that Meta's intention to serve ads on WhatsApp using personal data from Instagram and Facebook violates the GDPR and the EU Digital Markets Act. The organization says the proposed "Pay or Okay" model would not provide freely…
noyb · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 14, 2025
noyb sends cease and desist letter to Meta over AI training using EU personal data
noyb has issued a cease and desist letter to Meta, alleging that the company will use EU personal data from Instagram and Facebook for AI training without opt‑in consent. The letter relies on the EU Collective Redress Directive, which…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
DE-NRW · May 6, 2025
Consumer group asks Meta to stop AI training on EU user data
The Verbraucherzentrale North Rhine-Westphalia sent Meta a cease‑and‑desist letter on 30 April 2025 demanding it halt the use of Instagram and Facebook posts for AI training, citing GDPR consent requirements. Noyb supports the request…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 24, 2025
noyb files GDPR complaint against Ubisoft for forced online tracking of offline games
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Ubisoft requires players to be online for single‑player games, collecting personal data such as start time, duration and quit time. The complaint argues the…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 12, 2024
noyb files complaint against BeReal for forced consent dark pattern in France
noyb has lodged a complaint with the French data protection authority (CNIL) alleging that BeReal uses a dark‑pattern consent banner that forces users to accept tracking for advertising. The complaint argues the consent is not freely…
CNIL · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Nov 12, 2024
Meta proposes "less personalized" ads that use location and age without consent, sparking GDPR enforcement concerns
Meta announced a new ad option that will still use personal data such as location and date of birth without obtaining consent, which noyb says violates the GDPR. The organization has filed pending litigation against Meta for this and…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
France · Oct 22, 2024
noyb files complaint against Pinterest for unlawful tracking without consent
noyb lodged a complaint with the French data protection authority (CNIL) alleging that Pinterest tracks EU users for personalised advertising without obtaining opt‑in consent. The complaint cites a CJEU ruling that legitimate interest…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Sep 25, 2024
noyb files complaint against Mozilla over default ‘Privacy Preserving Attribution’ feature in Firefox
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Mozilla enabled a ‘Privacy Preserving Attribution’ feature in Firefox by default without informing users or obtaining consent. The feature allows Firefox to…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
In effect
Belgium · Sep 12, 2024
Belgian DPA orders Mediahuis news sites to add reject button to cookie banners, imposes daily penalty
The Belgian Data Protection Authority ordered four Mediahuis news sites to add a “reject” button on the first layer of their cookie banners and to change misleading button colours. Non‑compliance triggers a penalty of €50,000 per day per…
Belgian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Greece · Aug 13, 2024
Greek supermarket Alfa Vita faces GDPR complaint over incomplete data access
noyb filed a complaint with the Greek Data Protection Authority alleging that Alfa Vita's loyalty‑card program fails to provide full data‑subject access, omitting personal data and recipient information. The complaint cites a Court of…
Greek Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 12, 2024
noyb files nine GDPR complaints against X over AI training of 60 million EU users
noyb has lodged GDPR complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Spain and Poland alleging that X used personal data of over 60 million EU/EEA users to train its AI system without consent. The Irish…
Irish Data Protection Commission · General Data Protection Regulation
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Jun 14, 2024 · effective Jun 14, 2024
Meta pauses AI training on EU/EEA user data after DPC intervention
The Irish Data Protection Commission announced that Meta has committed to stop processing EU/EEA user data for undefined AI techniques following 11 noyb complaints. Meta had previously relied on a "legitimate interest" argument. The…
Data Protection Commission (DPC) · General Data Protection Regulation
